Silver Square 64 @silversquare64-blog - Tumblr Blog

Posts

Upon cruising the waters of the interwebz, we came across the USS TWHL.info. It appeared to have a hole in the ID param... We shall now board the vessel and retrieve our booty!

#TWHL #SS64 #SQL injection

Hey guys/ladies, I see you've found some vulnerabilities in my site. Any chance you'd be willing to share some info about where the holes were? This could be a stellar lesson on building secure websites for me. Also, I see you've published some information about my users. I need to inform them that their personal data has been compromised, what kind of reprecussions should they expect from this if you don't mind sharing?

Hey evohollywood!

For one, thank you for not starting with a rant and instead being courteous and polite. It says a lot about a person. Additionally, thank you for not threatening to report us... threats don't get you anywhere.

As to your website... We managed to get in using something called SQL injection which allows a hacker to modify the web developer's SQL queries to do whatever he wants. For example, depending on the command, we may have been able to delete the database, change passwords, etc.

In addition, another good measure it to check where a user is logging in from when checking the login request and make sure that it comes from your login.php page.

As for your users, only a few passwords were cracked, so it shouldn't be a problem. Tell user's to change their passwords to PieVsCake. In addition, warn users who use the same password for their email that since their emails were released, they should change email passwords.

In addition, don't feel bad. A lot of websites get hacked everyday... your luck was being hacked by a non-malicious hacking team ;) Simply fix your code, get back up, and make another attempt. If you ever have any questions, please feel free to ask us here. We would like to extend our friendship to you. As you can see, we aren't like most hackers. ;)

We have amended our title, to reflect the fact that it is fixed/being fixed.

Sincerely,

Silver Square 64

P.S. Two good articles on SQL injection are

PHP.net

Tizag

Contact with the webmaster of PieVsCake has been made. A round of applause for evohollywood for not being an ass. We have instructed him on fixing his site. The vulnerability has been fixed.

#Pie #PieVsCake #Fixed

*PASSWORDS CRACKED*

Target: Pie Vs. Cake Example URL: http://bit[dot]ly/vhRcw3 Injection Point: ID [GET] See Link for Full Report

--------------------------------------------------------------

To login, use the following instructions:

Make a new .HTML with the following contents:

<html>

<body>

<p>E-mail Address: <input type="text" name="email" size="20" maxlength="80" /></p>

<p>Password: <input type="password" name="pass" size="20" maxlength="20" /></p>

</form>

</body>

</html>

Save it as whatever you want

Open it in a web browser

* Can only use passwords which are clear text and not hashed.

#PieVsCake #Paste #pastebin #sql injection #SS64 #Silver Square 64

Continuing work on #pievscake. Lot's of juicy stuff ;) #se

We would like to offer our support to Hillary Adams.

This Halloween the most popular mask is the Arnold Schwarzenegger mask. And the best part? With a mouth full of candy you will sound just like him.

- Conan O'Brien. Happy Halloween and have fun trick or treating!

#halloween #Arnold Schwarzenegger

Target: Greenberg Quinlan Rosner Research Example URL: http://z27[dot]us/kij8 Injection Point: ID [GET] See Link for Full Report

#GET #greenberg #greenberg quinlan rosner research #injection #pastebin #quinlan #release #research #rosner #sql #sql injection #ss64

Trending Blogs

Recently Viewed Blogs

Silver Square 64